Companies Are Not Prepared for the New European General Data Protection Regulation

Symantec, a global leader in cybersecurity, recently announced that 96 percent of companies in Europe still do not fully understand the provisions brought by the European General Data Protection Regulation (GDPR), despite it being applicable from May 2018. The results of Symantec’s research, conducted on a sample of over 900 companies in the United Kingdom, France, and Germany, show that 91 percent of respondents are not confident they will achieve compliance with this regulation on time. The research also revealed that only 22 percent of companies consider compliance with GDPR a key priority in the next two years, despite only 26 percent of respondents believing their organization is fully prepared for the implementation of GDPR.

– These results show not only that companies are completely unprepared for the introduction of GDPR, but also that the preparation process is not being carried out quickly enough, said Kevin Isaac, Senior Vice President of Symantec. – There is a significant gap between how important security and privacy are to users and how important these areas are to companies. However, the good news is that there is still enough time to rectify the situation – but only if companies take appropriate steps immediately, emphasizes Isaac.

Lack of Awareness of the Regulation Among all respondents, nearly a quarter (23 percent) say their organization will not be compliant with GDPR at all or will not achieve full compliance by the deadline, i.e., by 2018. Among these companies, only one-fifth believe it will even be possible to comply with GDPR within any timeframe, and nearly half (49 percent) believe that only some departments of the company will be able to achieve a level of full compliance while it will be impossible for others. Due to this overwhelming impression that it will be difficult to meet the set deadline of May 2018, many companies are at risk of incurring hefty fines.

Out of Step with User Expectations Regarding Privacy While companies struggle to achieve compliance with GDPR, we can also say that they remain significantly out of step with user expectations, especially when it comes to data privacy and security. Almost three-quarters of companies (74 percent) do not believe that the company’s approach to privacy is among the top three factors when users choose whom to do business with, despite users inquiring about transaction security in more than one-third of cases (36 percent). Equally concerning is the fact that as many as 35 percent of respondents say they do not believe their organization acts ethically when it comes to securing and protecting data.

All this data shows that there is a significant gap between companies and the priorities of users themselves. Symantec’s Privacy Report previously established that 88 percent of European users see data security as the most important factor when choosing a company to do business with. Moreover, 86 percent of respondents then stated that this issue is more important to them than product quality.

It is therefore not surprising that the report on the current state of data privacy protection in Europe (State of European Data Privacy) concluded that 55 percent of companies are not at all confident that they meet the security requirements of their users in this segment.

Cultural Preparedness Symantec’s research also found that many companies have not even begun to work on the organizational and cultural changes they must implement in their organization before May 2018. For example, the research showed that:

• Nearly one in ten respondents (9 percent) say that all employees have access to personal data of users. • Six percent of respondents say that all employees of the company have access to payment information of the company’s users. • Only 14 percent of respondents believe that it is the responsibility of every employee in the company to ensure that data is protected.

With such obvious, broad access to personal data of users that many companies allow their employees, it can be said that companies seriously underestimate the challenges they will face on the path to implementing the General Data Protection Regulation, i.e., GDPR.

In addition, the research concluded the following:

• Less than half of respondents (47 percent) say that ethical management of personal data is a main priority for their organization, and less than half again said they would enhance security training and education. • Only 27 percent of companies plan to completely restructure and significantly renew their overall approach to data security as a kind of response to GDPR.

Technical Readiness and the Right to be Forgotten • 91 percent of companies are concerned about their ability to comply with GDPR on time, primarily due to factors such as the complexity of accurate data processing, available time, and potential costs. • Only 28 percent of managers who oversee IT and business decisions understand that the right to be forgotten is part of GDPR regulation. • 90 percent of companies say that users who request that their data be completely deleted will pose a significant challenge for the organization. • Only 9 percent of respondents have so far received requests for the deletion of user data. • 81 percent of respondents believe that their users will at some point request the deletion of their data. • However, 60 percent of companies currently do not have defined procedures and business processes that would allow them to respond to these requests.

– Companies must be aware that privacy, security, and compliance with GDPR are extremely important for the reputation of their brands, says Kevin Isaac. – Their response to the regulation established by GDPR should be a key element of organizational design and company culture. Accepting only a partial approach that will satisfy only some segments of GDPR will create more problems for companies than it will solve, emphasizes Isaac.

– Whether companies will successfully implement GDPR regulation primarily depends on their readiness to adopt a business process design that fundamentally incorporates data privacy. Companies must also understand that good security and privacy represent a significant competitive advantage and can be a good step towards gaining user trust, while also, of course, ensuring that companies meet regulatory requirements, highlighted Peter Gooch, a partner at Deloitte, specializing in security.